☰

dig 不会解析不合格的域名，但 nslookup 会解析

tag-icon • tag-icon bind dig nslookup
dig 不会解析不合格的域名，但 nslookup 会解析

我有一个实验室，在 CentOS7 服务器上运行 DNS ( dns01.local.lab)。该local.lab域定义在named.conf：

zone "local.lab" IN {
    type master;
    file "local.lab.zone";
    allow-update { none; };
};

我也有一个反向区域，但据我所知，这对于这个问题并不重要。

区域文件如下所示：

$TTL 86400
@  IN SOA  dns01.local.lab. root.local.lab. (
    1 ; Serial
    3600 ; Refresh
    1800 ; Retry
    604800 ; Expire
    86400 ; Minimum TTL
)
@        IN NS  dns01.local.lab.
@        IN A   192.168.122.100
@        IN A   192.168.122.1
dns01      IN A 192.168.122.100
virt-host  IN A 192.168.122.1

如果我nslookup只使用主机名，我会得到解析的 IP：

[root@dns01 ~]# nslookup dns01
Server:          192.168.122.100
Address:         192.168.122.100#53

Name:    dns01.local.lab
Address:  192.168.122.100

但是，如果我dig仅使用主机名，我不会得到预期的响应：

[root@dns01 ~]# dig dns01

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 <<>> dns01
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9070
;; flags: qr rd ra ad; QUERY: 1, ANSWER 0; AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns01.                         IN        A

;; AUTHORITY SECTION:
.                       10800   IN        SOA    a.root-servers.net. nstld.verisign-grs.com. 2016020401 1800 900 604800 86400

;; Query time: 95 msec
;; SERVER: 192.168.122.100#53(192.168.122.100)
;; WHEN: Thu Feb 04 09:15:07 HST 2016
;; MSG SIZE  rcvd: 109

当我使用 FQDN 时，我只会得到预期的响应：

[root@dns01 ~]# dig dns01.local.lab

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.2 <<>> dns01
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9070
;; flags: qr rd ra ad; QUERY: 1, ANSWER 1; AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns01.local.lab.               IN        A

;; ANSWER SECTION:
dns01.local.lab.        86400   IN        A        192.168.122.100

;; AUTHORITY SECTION:
local.lab.              86400   IN        NS       dns01.local.lab.

;; Query time: 8 msec
;; SERVER: 192.168.122.100#53(192.168.122.100)
;; WHEN: Thu Feb 04 09:22:15 HST 2016
;; MSG SIZE  rcvd: 74

反向查找dig提供预期的答案。同样与nslookup.

我知道dig并nslookup使用不同的解析器库，但据我了解dig被认为是更好的方式。

如上面的结果所示，正在查询正确的命名服务器。就好像dig不认识服务器是被查询主机名的权威一样。

named.conf:

options {
    listen-on port 53 { 127.0.0.1; 192.168.122.100; };
    directory    "/var/named";
    dump-file    "/var/named/data/cache_dump.db";
    statistics-file    "/var/named/data/named_stats.txt";
    memstatistics-file    "/var/named/data/named_mem_stats.txt";
    allow-query    {localhost; 192.168.122.0/24; };
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";
    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};

zone "." IN {
    type hint;
    file "named.ca";
};

zone "local.lab" IN {
    type master;
    file "local.lab.zone";
    allow-update { none; };
};

zone "122.168.192.in-addr.arpa" IN {
    type master;
    file "local.lab.revzone";
    allow-update { none; };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

答案1

能给dig +search dns01你你想要的吗？如果是这样，有可能以+nosearch某种方式添加到您的~/.digrc?

ETA：或者，如果您像我一样，也许挖掘仙女未能来添加+search到您的~/.digrc.

相关内容